1. Who we are and our role
Endpoint Shield is developed and operated by Nam Nguyen Cong, Vietnam ("we"). Organisations ("customers") install the Endpoint Shield agent on devices they manage and use the console to protect them. For data collected from those devices and their users, the customer decides what is collected and why, and we process it on the customer's behalf and on its instructions. For the accounts of people who sign in to the console, and for this website, we are responsible for the data.
2. What the agent collects from a device
The agent runs on the device and detects threats there. It sends to the customer's console:
- Device information: host name, operating system and version, agent version, and security settings (for example whether the firewall and disk encryption are on, antivirus status, number of administrator accounts).
- Security alerts: which rule matched, when, the program involved (name, path, file hash), the chain of programs that started it, the user account it ran as, and the target (for example a file path, a network address, or a command line with secrets removed).
- Activity records (where the customer uses activity search): program starts and stops with their command lines (secrets removed), selected file changes, and network connections with the remote address and port.
- Secret findings: when a password, token or key is found in a file on the device, only its type, the file path, the line number and a keyed fingerprint. The secret itself is never sent.
- Response results: the outcome of actions the customer's team takes (for example "process stopped", "file quarantined"), and triage packages the team asks for, which contain lists of programs, connections, startup items and settings — not file contents.
The agent does not collect file contents, documents, e-mails, keystrokes, screenshots, browsing history or web page content, microphone or camera input, or location. Quarantined files stay on the device.
3. What we collect from console users
Name and e-mail address, role, sign-in records (time, address, result), a record of actions taken in the console (an audit log the customer can export), and settings the customer enters. Passwords are stored only as salted hashes; authenticator secrets and keys customers enter (for example for integrations) are stored encrypted.
4. How the data is used
Only to provide the service to the customer: detecting and alerting on threats, letting the customer's team investigate and respond, showing device health and security settings, delivering agent updates, and keeping the service secure and working. We do not sell data, use it for advertising, or build profiles of people. We do not use customer data to train machine-learning models.
5. Optional features that involve third parties
- AI triage assistant (off by default; a customer administrator turns it on with the customer's own API key): when an analyst asks for it, the incident's alert details are sent to Anthropic's Claude API for a summary. Device names, user names, e-mail addresses and anything that looks like a secret are replaced before sending. Anthropic processes this data under the customer's own agreement with Anthropic.
- Notifications: if a customer connects Slack or Microsoft Teams, alert summaries are sent there.
- Threat intelligence: the console downloads public lists of known-bad file hashes and addresses; no customer data is sent to those sources.
6. Where data is kept, and for how long
The console is hosted in Vietnam, with traffic carried over encrypted connections (Cloudflare provides the network edge). Retention in the console: alerts and secret findings 90 days, activity records 30 days, the audit log and account data for as long as the customer's account exists. On the device, the agent keeps its own alerts for up to 90 days and activity records for up to 7 days. When a customer ends the service, we delete its data within 30 days, unless the law requires us to keep it.
7. Security
- Each customer's data is kept separate; console users only see the organisations they have been given access to.
- Data travels over encrypted connections. Console sign-in requires a second factor or single sign-on.
- Response commands, policies and agent updates are signed by the customer's console and checked by each device.
- The agent protects itself against being stopped or removed without the customer's authorisation.
8. Your choices and rights
If you use a device protected by Endpoint Shield, the organisation that manages it decides how the agent is used — please contact it first; we will help it answer your request. Console users and visitors can ask us for access to, correction of, or deletion of their personal data at the address below. We answer within 30 days.
9. This website
This website uses no cookies, analytics, trackers or third-party scripts. The hosting provider may keep standard access logs (address, time, page) for security for a short period.
10. Children
Endpoint Shield is a business product and is not directed at children.
11. Changes
We will post changes here with a new effective date, and tell customers by e-mail before material changes take effect.
12. Contact
Nam Nguyen Cong, Vietnam — namcf1988@gmail.com